If I Had Only 20 Seconds To Teach People How To Avoid Scams

Human risk management involves more than security awareness training, but training is a huge part of the mix.

How else are you going to best fight a cyberthreat that is responsible for 70% to 90% of all successful data breaches after already bypassing every technical cybersecurity defense you threw in its way? 

At some point, a harmful scam message will make it to a user, and that user will be called upon to evaluate its importance and treatment. The user will be called upon to make a security decision that will impact their future happiness and maybe that of their employer. 

Training people how to recognize and mitigate scams as effectively as possible isn’t easy, especially in today’s world, where anyone can use an AI-enabled deepfake to try to scam anyone else. 

But if I had only 20 seconds to teach the most effective anti-scam lesson to everyone I could, it would be this:

If a message arrives unexpectedly and asks you to do something you’ve never done before (at least for that requestor), research the request using an alternate trusted method before performing. Here’s how I represent that statement graphically:

Any message containing these two traits is at far higher risk of being a social engineering scam than other messages. Not every scam meets these criteria, but 99% do. 

I don’t care how the message arrives. It could be in email, an SMS, a WhatsApp message, in social media, in a work chat channel, a phone call…it could even be in person. If the message arrives and you were not expecting it…that’s already one of two risky traits. 

Second, the request is asking you to do something you haven’t done before. Usually, the request is passed along with text or audio indicating you need to do the requested action RIGHT NOW!! It claims that if you don’t follow the instructions, some type of harm, usually financial, will befall you or your company. You or your employer will be charged money you/they don’t owe, lose money you/they could otherwise be earning, or miss out on some easy cash payout. 

There are so many outlier scam messages that try to motivate you in different ways, such as your child being kidnapped, a blooming romance, you missing out on getting a wanted vaccine, or some patriotic call to duty. There are so many ways to motivate people to respond to a message that I just leave out that part of the scam puzzle.

I keep it simple.

If a message arrives unexpectedly and asks you to do something you’ve never done before, slow down and research it better before performing.

Don’t use any of the contact information in the message. Scammers provide fake email addresses, fraudulent spoofed links, and phone numbers that lead to phony call centers. Best if you try to contact the sender by a known, good phone number, go to the company’s legitimate website, or look up the company’s phone number on their legitimate website. Don’t trust phone number lookups in internet search engines. Many malicious phone numbers end up being mistakenly listed as legit because the scammer has sent out the fake phone number so much that it “poisons” the internet search engine.

I find that when I read a message containing these two scam clues – it arrives unexpectedly and asks you to do something you’ve never done before – that my initial reaction is usually, “Huh!??”

So, I’ve trained myself to associate the “Huh!??” moment when reading a new message with, “Hey, is that a scam?”

It’s easier said than done. 

I came up with the concept, and it took me a few months to really get it ingrained into my brain and behavior. But now when I get a “Huh!??”-inducing message, I immediately slow down and better evaluate the message.

We all get new, unexpected messages every day. Heck, I think that’s what it means to be an employee. Your boss is sending you all types of unexpected messages all the time. And your boss…or the IRS…or LinkedIn…really could be sending you an unexpected message asking you to do something new for the first time. It happens. 

Just realize that any message containing those two traits is higher risk than messages that don’t and react accordingly. 

It just could save you and your employer a lot of heartache and recovery.